Install ModSecurity on Apache for Ubuntu: A Comprehensive Guide

How to install ModSec with Apache on Ubuntu Linux

ModSecurity Apache Ubuntu setups require installing 💿 the firewall module directly onto your web server to block common online attacks. ModSecurity (a web application firewall that filters incoming web traffic to protect your server) runs alongside Apache to add an essential layer of security for your website.

Here is how to install it 💿 with the Apache HTTP server.

Install ModSecurity and Apache

Install ModSecurity and Apache on your Ubuntu server using the built-in package manager to quickly add web traffic filtering. Run standard terminal commands to download the ⬇️ Apache web server along with the ModSecurity module, then verify the installation using the Apache control tool to make sure the module is active.

sudo apt update
sudo apt install apache2 libapache2-mod-security2

Checking that ModSec is installed involves running the commands below.

apachectl -M | grep security

The command above should produce an output similar to this:

ModSecurity's Apache module remains disabled by default. Turning on the ModSecurity module requires running the commands presented below. Enabling this module is crucial for activating ModSecurity's web application firewall features, which protect the website.

ModSecurity configuration on the Apache server in Ubuntu actively blocks threats by adjusting main settings. Begin by copying the recommended configuration file, modsecurity.conf-recommended, and then edit this file to best protect the server.

The default configuration file sits at /etc/modsecurity/modsecurity.conf-recommended. Copy this file and rename it to modsecurity.conf.

sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

Next, run the commands below to open the newly created config file.

sudo nano /etc/modsecurity/modsecurity.conf

Change the highlighted lines in the file from DetectionOnly to On.

# -- Rule engine initialization ----------------------------------------------
# Enable ModSecurity, attaching it to every transaction. Use detection
# only to start with, because that minimises the chances of post-installation
# disruption.
#
SecRuleEngine On

# -- Request body handling ---------------------------------------------------
# Allow ModSecurity to access request bodies. If you don't, ModSecurity
# won't be able to see any POST parameters, which opens a large security
# hole for attackers to exploit.

SecRequestBodyAccess On

# Enable XML request body parser.
# Initiate XML Processor in case of xml content-type

Save and exit, then restart Apache.

sudo systemctl restart apache2

Add OWASP ModSecurity rules

Add OWASP ModSecurity rules to your Ubuntu server by cloning the latest Core Rule Set directly from GitHub into your system directories. This step equips your firewall with a robust set of detection rules to defend web applications against common security threats and unauthorized access attempts.

Clone the latest OWASP CRS from GitHub to the /usr/share/ directory by running the commands below.

sudo rm -rf /usr/share/modsecurity-crs
sudo git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git /usr/share/modsecurity-crs

Next, rename the example file to crs-setup.conf.

sudo mv /usr/share/modsecurity-crs/crs-setup.conf.example /usr/share/modsecurity-crs/crs-setup.conf

Next, run the commands below to open the ModSec security configuration file.

sudo nano /etc/apache2/mods-enabled/security2.conf

Then, edit the highlighted lines to enable the OWASP rules downloaded above.

<IfModule security2_module>
        # Default Debian dir for modsecurity's persistent data
        SecDataDir /var/cache/modsecurity
		
        # Include all the *.conf files in /etc/modsecurity.
        # Keeping your local configuration in that directory
        # will allow for an easy upgrade of THIS file and
        # make your life easier
        IncludeOptional /etc/modsecurity/*.conf
		
        # Include OWASP ModSecurity CRS rules if installed

        IncludeOptional /usr/share/modsecurity-crs/*.conf
        IncludeOptional /usr/share/modsecurity-crs/rules/*.conf
</IfModule>

Save and exit.

Restart Apache to finish the process.

sudo systemctl restart apache2

To test that ModSec runs correctly, execute the commands below.

curl 'http://127.0.0.1/test.html?a=<script>alert(1);</script>'

An output message similar to the one below should appear:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
<hr>
<address>Apache/2.4.52 (Ubuntu) Server at 127.0.0.1 Port 80</address>
</body></html>

That completes the setup.

Conclusion:

• ModSecurity is a powerful open-source web application firewall (WAF) that offers an extra layer of security to detect and prevent attacks before they reach the web application.
• Following the installation steps outlined above, you can successfully set up ModSecurity with Apache on Ubuntu Linux.
• OWASP ModSecurity rules, when applied, provide recommended security settings to protect your applications further.
• After completing the installation and configuration, you can verify the functionality of ModSecurity by testing it with a sample HTTP request.
• Your feedback is welcomed, and please feel free to use the comment form below to report any errors or add additional insights.